This exploratory empirical paper investigates whether the sharing of unique malware files between domains is empirically associated with the sharing of Internet Protocol (IP) addresses and the sharing of normal, non-malware files. By utilizing a graph theoretical approach with a web crawling dataset from F-Secure, the paper finds no robust statistical associations, however. Unlike what might be expected from the still continuing popularity of shared hosting services, the sharing of IP addresses through the domain name system (DNS) seems to neither increase nor decrease the sharing of malware files. In addition to these exploratory empirical results, the paper contributes to the field of DNS mining by elaborating graph theoretical representations that are applicable for analyzing different network forensics problems.
Jukka Ruohonen (University of Turku), Sanja Šćepanović (Aalto University), Sami Hyrynsalmi (University of Turku), Igor Mishkovski (Aalto University, University of Ss. Cyril), Tuomas Aura (Aalto University), Ville Leppänen (University of Turku): Correlating file-based malware graphs against the empirical ground truth of DNS graphs
Presented at ECSAW ’16, the 10th European Conference on Software Architecture Workshops, Copenhagen